Ransomware gangs now outing victim businesses that don't pay

If you don't pay and they expose your data to the world, doesn't that mean you can effectively get it back without paying?

On the plus side, you get your data back.

Kidding aside, these are serious breaches and it would be good to at least have the names of the companies out there. By law they were required to report anyway and the local authorities in turn would publish / fine.

So downloading this data would be strictly off-limits but the names of the companies should be public so that people at least have a chance to know that they have been affected.

One way of leaving it to the people to make the wealth trickle down!

Looks like they're doing our job.

First, the message was "backup your data". Now, they also added "encrypt your data"!

Shouldn't any breach like that automatically be treated as data breach? I mean, maybe the crooks wouldn't publish the data, but they certainly had access to it and could resell it to whoever is willing to pay anyway, even if you paid the ransom. There's no way to ensure that doesn't happen.

Yeah but reporting on "cybercrime" sounds a lot more glamorous than reporting on "crime."

Add to your favorite text substitution add-on the mapping "cyber" -> "spider" and you'll be less annoyed at its pervasive use.

"ship-helmsmen-turned-criminals"

To be fair, if you are taken over by ransomware, it's probably the best decision to start from scratch and redesign your network so that this sort of thing is mitigated in the future.

One thing to do to slow down such downloading is to add a great deal of bulk "junk" data, and have a rate limited network connection.

Krebs has a better measured reply to the "Nuke 'em all!" comments.

https://krebsonsecurity.com/2019/12/ransomware-gangs-now-out...

What needs to become the norm for the US Govt response to these gangsters is for them to get in the habit of doing what they did in the Evil Corp case: Once the offenders are positively identified, get the Treasury to issue financial sanctions on them that prevent the crooks from transacting with people and businesses outside their home country.

https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-...

This is perhaps the most effective tool in law enforcement’s hands to combat cybercrime — short of apprehending the bad guys. None of these dudes want to be stuck in Russia, and they sure as hell don’t want all their money kept their either. Rather, they tend to launder it by investing in properties and other businesses outside their own country. Making it a crime for others to accept their money is an extremely effective way of frustrating these criminals.

Usually you can't. Services depend on user data, so the company needs the key.

It works only for storage service basically (or messaging, where the two have the keys).

For many businesses that's not really possible. For your standard e-commerce website the majority of the data you have is what people are ordering. How do you end-to-end encrypt that? What about internal documents and memos? User names and email addresses (not as valuable as passwords but still useful if you join it against other data sets)?

I assume most of these occur through phishing and very few occur by someone sniffing unencrypted data in transit.

I would bet most of this users clicking things they should not. recently my company put out a phishing email and people clicked on it and then started a thread on the internal forums about how mad they were the company would do this (they had to take extra training if the fell for it). Another co worker was telling me about his old position where he put the thumb drives in parking lots and people would pick them up and plug them into their work computer, and the would get mad that their security team did this exercise and caught them.

Yes a lot can still be done with security on machines and traffic, etc.... But the human factor is hard to control and fix. If someone sent out a phishing email with a link that said "click here to see magical unicorns jumping over a rainbow", someone would click it, i know poeple i work with who would click it. It gets, frustrating at least for me, since i have a lot to do with security where i am at.

Encryption will do nothing to stop this. If a user clicks a link and gets the malware, the malware will be doing it's damage inside of the encryption envelope or encrypting already encrypted data which has the same effect.

>anyone connected to the domain and the hosting asn and the ISP is going to have good opsec

Why would the hosting company/ISP be at risk? Just run it from a non-US extradition friendly country, and say that you won't take any action unless there's a court order from your local court.

Facebook is so big and so much money is involved there that I think a hacker wouldn't be able to get much out of Facebook. When you steal billions from people then rules sometimes get bent when dealing with you.

What incentive would the hackers have for actually deleting their copy after receiving payment?

Obviously even if someone did have that link they should not post it here. Giving wider visibility to this makes the problem worse, though I'm all for releasing the names of those companies.

It's indexed on Google and you can find it by searching for phrases from the posted screenshots. Be careful opening the files on there.

Absolutely, and this is problematic because now we end up with a set of incentives that works against the public interest. This will make it more likely for the companies affected to pay up. The one bit of light here is that it will show up in their accounting and auditors tend to have reporting obligations if they come across evidence of a crime.

Yes, if you read far enough the hackers point this out. They're asking for less money than the EU fine for non-disclosure.

Viewed from the 'sometimes things have to get worse before they get better' lens, it might drive better security/backups/etc in the medium term.

> Not disclosing breaches is now a punishable offense, and this becomes a weapon in the hands of malicious hackers.

Maybe that wasn't meant as such, but it comes across, at least to me, as an argument that making non-disclosure punishable was a bad idea. If that was the argument, then I'd point out that the same thing can be said of criminalising any offence at all.

From article 4:

(12) ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

So it seems that a ransomware attack is considered a breach - as it should be - and neither exfiltration nor disclosure is necessary for that to be the case.

Any sort of access is a weapon in the hands of a malicious hacker. Penalties for allowing it to happen are weapons in the hands of those trying to do something about it.